VPS vs VPN: what each one is, and when you need which

Short answer: a VPS (virtual private server) is a virtual machine you rent in a data centre, with its own operating system, public IP address and root access, on which you run whatever software you like. A VPN (virtual private network) is an encrypted tunnel that carries your device’s traffic to another server, so your local network sees only encrypted data and websites see that server’s IP instead of yours. They solve different problems, and they meet in one place: you can run your own VPN on a VPS.

If you want to host something, such as a website, a bot, a game server or a remote desktop, you need a VPS. If you want to protect or relocate your own connection, you need a VPN, either from a VPN company or one you run yourself on a VPS.

What is the difference between a VPS and a VPN?

The names cause the confusion: both start with “virtual private”. In a VPS, “private” means the machine is yours and not shared with other customers’ software. In a VPN, it means your traffic travels through a tunnel that outsiders cannot read.

What is a VPS for?

A VPS is a server that runs around the clock, whether your own computer is on or not. Typical uses:

• Hosting websites, APIs and databases.
• Running Discord or Telegram bots, scrapers, cron jobs and other automation.
• Game servers for you and your friends.
• A Windows desktop in a data centre, reached over Remote Desktop.
• Development and staging environments.
• Your own VPN, proxy or Tor relay.

On a KVM VPS you get a full virtual machine with its own kernel, so you can load kernel modules such as WireGuard’s. Container-based VPS types share the host’s kernel and often cannot, as the KVM vs OpenVZ comparison explains.

What does a VPN do, and what does it not?

A VPN, whether bought or self-hosted, does three things well:

• It encrypts everything between your device and the VPN server. The café Wi-Fi, the hotel network and your ISP see encrypted traffic to one address, not which sites you visit.
• Websites see the VPN server’s IP address and location instead of yours.
• It can get you past some network blocks, for example on a school or office network.

What it does not do:

• It does not make you anonymous. Cookies, logins, browser fingerprinting and tracking pixels identify you no matter which IP you come from.
• It does not remove trust, it moves it. What your ISP could see before, the VPN operator can see now: which servers you connect to, when, and how much. The operator also holds your payment details and must answer to the law where it operates.
• It adds little on top of HTTPS for content. Most sites already encrypt what you send them. On a hostile network the VPN mainly hides which sites you use.

Which one do you need?

How do you run your own VPN on a VPS?

WireGuard is the usual choice today. It is small, fast and runs over UDP, and it has been part of the Linux kernel since version 5.6, so the stock kernels of Debian 12 and 13 and Ubuntu 22.04 and 24.04 include it. Setup takes a server config, a firewall rule for one UDP port and a config per device. Our WireGuard VPN server guide covers it step by step, including phones and IPv6.

OpenVPN is older and takes longer to set up. Its advantage is that it can run over TCP as well as UDP, which helps on networks that block UDP. Its default is port 1194 over UDP.

For a quick test without installing anything on the server, SSH can act as a SOCKS proxy. It only covers the apps you point at it, not the whole device:

ssh -D 1080 -N user@203.0.113.10
# keep this window open, then set your browser's proxy to
# SOCKS v5, host 127.0.0.1, port 1080

In Firefox, also tick Proxy DNS when using SOCKS v5 in the connection settings. Without it, the browser still asks your local resolver for every hostname, and the network you are on can see each site name.

How do you check that the VPN is really used?

A VPN that is connected is not always a VPN that carries everything. With the tunnel up, ask an IP echo service which address it sees:

curl -4 https://icanhazip.com    # must print the VPS's IPv4 address
curl -6 https://icanhazip.com    # must print the VPS's IPv6 address, or fail

• Your home IPv4 address appears: the tunnel is up, but the default route does not go through it. In WireGuard, the client’s AllowedIPs = 0.0.0.0/0, ::/0 sends everything into the tunnel.
• The IPv4 address is right, but your own IPv6 address appears: the tunnel carries only IPv4, and every site that supports IPv6 still sees you. Tunnel IPv6 as well, or turn it off on the device.
• Websites see the right IP, but DNS goes to your ISP: set a resolver inside the tunnel with a DNS = line in the client’s [Interface] section.

On Windows 10 and 11, run the same lines in PowerShell as curl.exe -4 and curl.exe -6, or open the address in a browser with the VPN switched on.

Is your own VPN more private than a VPN service?

It is a trade, and it goes in both directions:

The honest summary: a VPS gives up the crowd in exchange for control. Everything that leaves your VPN comes from one IP rented by one customer. A site you log into, or anyone who watches traffic over time, can tie that activity together. A commercial VPN mixes you in with other users, but asks you to trust its no-logs promise. Neither one makes you anonymous. If that is the goal, Tor is the tool, and our guide to anonymous VPS hosting covers what a host can and cannot know about you.

Where your own VPN clearly wins: you control the software and its logs, and nobody else uses the IP while it is yours, so other people’s behaviour cannot get it blocked. The exit IP never changes, so you can allowlist it for admin panels and databases. And you can add as many devices as you like.

How do a VPN and a VPS work together?

• You do not need a VPN to reach your VPS. SSH and Remote Desktop already encrypt the connection.
• A VPN can still protect it. Run WireGuard on the VPS and allow SSH or RDP only from the tunnel’s address range. The admin ports then disappear from the public internet, and so do the bots that try passwords on them all day.
• Careful with VPN clients on a server. If you install a VPN client on a VPS, all of its traffic goes into the tunnel, including the replies to your own SSH or RDP session, and the session drops. Exclude your own IP first, as shown in running a VPN on a Windows RDP server.

Running your own VPN on a VMHeaven VPS

• It is allowed. Our acceptable use policy lists running VPNs, proxies and privacy tools for personal use among the permitted uses. Everything the policy forbids stays forbidden when it leaves through your tunnel.
• It works. Every VPS plan is a KVM virtual machine with its own kernel, so WireGuard loads normally. The smallest Standard KVM plan is plenty for a personal VPN.
• Exit location: Amsterdam or Frankfurt, depending on the plan and current stock. A VPS in the Netherlands gives you a Dutch IP inside the EU.
• Traffic falls under a fair-use policy and is not billed per gigabyte.
• No ID check. Sign-up asks for an e-mail address, a name, a password and a postal address for the invoice. You can pay by card, PayPal or crypto (Bitcoin, Ethereum, USDT, Litecoin, Monero and more), as explained on the crypto VPS page.
• The limits, honestly: the IP is rented to you, and like any host we disclose data to authorities when the law requires it. Your own VPN keeps your traffic away from the networks you connect through. It does not hide it from the law.

Frequently asked